3.8
LowCVSS 3.1 · from CISA
CVE-2026-85007
YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
Video Player for YouTube · Improper access control · CWE-284AffectedVideo Player for YouTube
FixUpdate to 2.1.4 or newer
PublishedOct 29, 06:00 · WPScan
Scored3.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Description
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
From WPScan
Affected and fixed versions
ProductAffectedFixed inVideo Player for YouTubebefore 2.1.42.1.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known